Extracted

• • Target
    ab6a4a908aa3cb8d19dbb8ef224ca7a2ea54e8d9d6c912076637f294912b0be2
  • Size 45KB
  • SHA256 ab6a4a908aa3cb8d19dbb8ef224ca7a2ea54e8d9d6c912076637f294912b0be2
  • MD5 da44581cfaf5ecb3b49a90d281a3dc6c
  • SHA1 abf9eceaca5a768e0c602731a9afb0bc34cb4793
  • SHA512 99c49a99e4554d10481d278bed89e451eb7c819513c5f53ac15432632f50900389a3b63af20e1aa9048232854a3ac30c39ae0e4a3c70ae9fafb105db529fbd65
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAm8kLyuObvtkjZPICzjbcgX7ixME3bZjefm7Os+BDZO:kuSOpTPOP2W8LuyyjWC3bzXWxME3bZow
  • TLSH
    T155231B003BE9C12BF2BE4F7899F22145867AB2636603D9491CC451DB5723FC6DA42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2